# Have I Been Pwned



The breach database every security answer starts from — every known breach, an account's exposure, and the password check.



## Breach Database

Every known data breach — when, where, how many accounts, and exactly what leaked, biggest first.

- Method: `GET`
- Path: `/v1/security/breaches`

**Parameters**

| Name | Type | | Description |
|---|---|---|---|
| `domain` | string | optional | Only breaches at this domain, e.g. `adobe.com`. |
| `max_age` | integer (seconds) | optional | Ask for data no older than this. Clamped to the product's own floor, so it can narrow the window but never force a refresh on every call. |

**Example request**

```bash
curl https://api.diraz.ae/v1/security/breaches \
  -H "Authorization: Bearer drz_live_…"
```

**Example response**

```json
{
  "data": {
    "total": 1029,
    "breaches": [
      {
        "name": "Adobe",
        "title": "Adobe",
        "domain": "adobe.com",
        "breachDate": "2013-10-04",
        "addedDate": "2013-12-04",
        "pwnCount": 152445165,
        "dataClasses": ["Email addresses", "Password hints", "Passwords", "Usernames"],
        "verified": true,
        "sensitive": false,
        "url": "https://haveibeenpwned.com/breach/Adobe"
      }
    ]
  },
  "meta": {
    "request_id": "req_7Q2fK4mZ",
    "as_of": "2026-08-22T04:05:00.000Z",
    "age_seconds": 42,
    "next_update_at": "2026-08-23T04:05:00.000Z"
  }
}
```

## Pwned Password Check

Has this password appeared in a known breach? Send its SHA-1 hash — k-anonymity means only the first five characters ever leave — and get back how many times it has been seen.

- Method: `GET`
- Path: `/v1/security/pwned-password`

**Parameters**

| Name | Type | | Description |
|---|---|---|---|
| `hash` | string | required | The 40-character uppercase SHA-1 of the password to check. Never the password itself. |
| `max_age` | integer (seconds) | optional | Ask for data no older than this. Clamped to the product's own floor, so it can narrow the window but never force a refresh on every call. |

**Example request**

```bash
curl https://api.diraz.ae/v1/security/pwned-password \
  -H "Authorization: Bearer drz_live_…"
```

**Example response**

```json
{
  "data": {
    "prefix": "5BAA6",
    "suffix": "1E4C9B93F3F0682250B6CF8331B7EE68FD8",
    "count": 39566291,
    "pwned": true
  },
  "meta": {
    "request_id": "req_7Q2fK4mZ",
    "as_of": "2026-08-20T16:30:00.000Z",
    "age_seconds": 120,
    "next_update_at": "2026-08-20T17:00:00.000Z"
  }
}
```